-
server: adopt lint block, fix clippy, fmt
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Decompose AppState Phase 2: migrate pages/public + finish blog
-
Remediate audit Run 22 fix-first findings; bump to 0.10.8
-
Harden invites and TOTP replay; add enum-drift guard
-
Surface fragment render errors and de-fragilize two UX sinks (ultra-fuzz Run 12 UX)
-
Run CPU-bound Argon2 off the async runtime (ultra-fuzz Run 10 C1)
-
security: seal token-liveness, per-key identity, private-repo issue authz (ultra-fuzz Run 4, A+)
-
server: fix join-wizard HTMX validation input loss; clamp discover paging
-
Preserve input on non-HTMX join-wizard validation; add field id to ValidationError
-
launch-eve audit pass: Ultra Fuzz Runs #8-9 + cross-cutting sweeps
-
server: convert remaining identity-leak surfaces to MaybeUserVerified
-
server: audit MaybeUser sites; introduce MaybeUserVerified
-
R27-UX-M3: AppError::Validation now carries per-field errors
-
exorcise: B15b routes/pages/ + root routes doc comments
-
Add Email validated newtype, replace ad-hoc email handling